balena-wireguard | wireguard stack for balenacloud | VPN library

Yes, it's the principle of a VPN: bridge 2 networks, through the public internet, but with encrypted communication to keep the traffic secret.

Of course, there are limits and constraints: IP range overlap, routing, network announcement (BGE protocol if supported), firewalls,...

1. Once we use C/C++ to read file-descriptor, in NEPacketTunnelProvider like:

The answer lies probably in some kind of security policies in that company.

Maybe their VPN gateway is running an obsolete version of VPN server? Maybe, for the users' UX they're using Java Applet based VPN clients? New browsers don't allow running Java Applets (NPAPI in Firefox was abandoned in 2018).

Why not using other VPN solutions: maybe the cost of implementation (including trainings, auditing, etc) is too high, and the company has mitigated risks in some other ways (for example with strict Internet traffic filtering, allow-lists, Intrusion Detection Systems, etc.)? Maybe there are regulatory limitations, such as FIPS requirement for a VPN solution, which can't be met with popular VPN solutions?

If employees of that company can connect to the Internet without any restrictions (web sites' allow-list) the risk of introducing malware into company LANs is very high while using such outdated browsers. In big companies, such risks are mitigated with additional security controls.

To sum it up: I recommend getting knowledge with that company's internal security policies to get the whole picture.

I need now to reach it from host B.

You can't do this. VPC peering is not transitive. You can setup VPC connection to VPC B as well instead.

s2svpn would be great but my question is can a lambda function HTTP request route through that connection?

Sure. Lambdas can have a VPC subnet attached. It's a matter of configuring the subnet routing table / VPN configuration to route the traffic to the carrier through the VPN endpoint.

Also, can an AWS Lambda function maintain a static IP?

No. Depends. A VPC-attached Lambda will create an eni (network interface) in the subnet with internal (not fixed) subnet iP address. But the traffic can be routed though a fixed NAT or a VPN gateway.

That's the reason I asked which IP address needs to be fixed, on what level. The VPN has a fixed IP address. If the carrier enforces the VPN address whitelisting, lambda clients should be working. If a fixed IP of the internal network is required then you will need a fixed network interface (e.g. using EC2)

Here is a minimal example of a pod with OpenVPN client. I used kylemanna/openvpn as a server and to generate a basic client config. I only added two routes to the generated config to make it working. See below:

Call stopVPNTunnel() inside loadFromPreferences closure.

You could simplify it with your ~/.ssh/config on your local pc

It seems your IP is blocked or not allowed in the network policy in Snowflake. Can you reach out to users having AccountAdmin/SecurityAdmin privilege to allow your IP in Snowflake?

Ref: https://docs.snowflake.com/en/user-guide/network-policies.html